NETWORK-BASED REAL-TIME DISTRIBUTED DATA COMPLIANCE BROKER

• US 20160014140A1
• Filed: 07/14/2014
• Published: 01/14/2016
• Est. Priority Date: 07/14/2014
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: AKIREDDY, RAVI, ESTES, ROBERT S.
• Granted Patent: US 10,084,795 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 9/5055 considering software capabilities, i.e. software resources associated or available to the machine
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

In an embodiment, a data processing system comprises: one or more processors; one or more non-transitory computer-readable storage media storing sequences of instructions which, when executed by the one or more processors, cause the processor to perform: in a local data service, receiving a request for processing data; identifying one or more local policies applicable to the request; based, at least in part, on the one or more local policies, determining whether the request may be processed locally; in response to determining that the request may not be processed locally, transmitting the request to one or more remote brokers to cause the one or more remote brokers to determine a remote data service configured to process the request.

Claims

1. A data processing system comprising:

one or more processors;

one or more non-transitory computer-readable storage media storing sequences of instructions which, when executed by the one or more processors, cause the processor to perform;

in a local data service, receiving a request for processing data;

identifying one or more local policies applicable to the request;

based, at least in part, on the one or more local policies, determining whether the request may be processed locally;

in response to determining that the request may not be processed locally, transmitting the request to one or more remote brokers to cause the one or more remote brokers to determine a remote data service configured to process the request.

2. The system of claim 1, further comprising instructions which when executed cause:

sending a local policy request to a local policy access point to provide the one or more local policies that are applicable to the request;

upon receiving the one or more local policies, invoking a local policy execution point to cause the local policy execution point to apply the one or more local policies to the request to determine whether the request may be processed locally;

in response to determining that the request may be processed locally, invoking one or more local brokers to initiate processing of the request;

in response to determining that the request may not be processed locally, generating metadata indicating a preferred remote data service that is configured to process the request remotely.

3. The system of claim 2, wherein the instructions that cause transmitting the request to the one or more remote brokers further comprise instructions which when executed cause a particular remote broker, of the one or more remote brokers, to:

send a remote policy request and the metadata to a remote policy access point to provide one or more remote policies that are applicable to the request and the metadata; and

,

upon receiving the one or more remote policies, invoke a remote policy execution point to cause the remote policy execution point to apply the one or more remote policies to the request and the metadata to determine whether the particular remote data service is configured to process the request, and if so, transmitting the request to the particular remote data service for processing.

4. The system of claim 1, wherein the request is any one of:

a data record create request, a data record read request, a data record update request, or a data record delete request.

5. The system of claim 1, wherein the one or more local policies govern access to data persistently stored in local storage devices;

wherein the one or more remote policies govern access to data persistently stored in remote storage devices.

6. The system of claim 1, wherein the one or more brokers are federated brokers and cooperate with each other to ensure a uniform compliance with the one or more remote policies.

7. The system of claim 1, wherein the one or more remote brokers communicate with a policy administration point to obtain the one or more remote policies and updates for the one or more remote policies.

12. The method of claim 1, wherein the one or more local policies govern access to data persistently stored in local storage devices;

wherein the one or more remote policies govern access to data persistently stored in remote storage devices.

13. The method of claim 1, wherein the one or more brokers are federated brokers and cooperate with each other to ensure a uniform compliance with the one or more remote policies.

14. The method of claim 1, wherein the one or more remote brokers communicate with a policy administration point to obtain the one or more remote policies and updates for the one or more remote policies.

8. A data processing method comprising:

in a local data service, receiving a request for processing data;

identifying one or more local policies applicable to the request;

based, at least in part, on the one or more local policies, determining whether the request may be processed locally;

in response to determining that the request may not be processed locally, transmitting the request to one or more remote brokers to cause the one or more remote brokers to determine a remote data service configured to process the request;

wherein the method is performed using one or more computing devices.

9. The method of claim 8, further comprising:

sending a local policy request to a local policy access point to provide the one or more local policies that are applicable to the request;

upon receiving the one or more local policies, invoking a local policy execution point to cause the local policy execution point to apply the one or more local policies to the request to determine whether the request may be processed locally;

in response to determining that the request may be processed locally, invoking one or more local brokers to initiate processing of the request;

in response to determining that the request may not be processed locally, generating metadata indicating a preferred remote data service that is configured to process the request remotely.

10. The method of claim 9, further comprising:

causing a particular remote broker, of the one or more remote brokers, to;

send a remote policy request and the metadata to a remote policy access point to provide one or more remote policies that are applicable to the request and the metadata; and

,

upon receiving the one or more remote policies, invoke a remote policy execution point to cause the remote policy execution point to apply the one or more remote policies to the request and the metadata to determine whether the particular remote data service is configured to process the request, and if so, transmitting the request to the particular remote data service for processing.

11. The method of claim 8, wherein the request is any one of:

a data record create request, a data record read request, a data record update request, or a data record delete request.

15. A computer system comprising a server computer comprising one or more non-transitory computer-readable data storage media stored with one or more sequences of instructions which when executed using a particular user computer among a plurality of user computers cause the particular user computer to perform:

in a local data service, receiving a request for processing data;

identifying one or more local policies applicable to the request;

based, at least in part, on the one or more local policies, determining whether the request may be processed locally;

in response to determining that the request may not be processed locally, transmitting the request to one or more remote brokers to cause the one or more remote brokers to determine a remote data service configured to process the request.

16. The computer system of claim 15, further comprising instructions which when executed cause:

sending a local policy request to a local policy access point to provide the one or more local policies that are applicable to the request;

upon receiving the one or more local policies, invoking a local policy execution point to cause the local policy execution point to apply the one or more local policies to the request to determine whether the request may be processed locally;

in response to determining that the request may be processed locally, invoking one or more local brokers to initiate processing of the request;

in response to determining that the request may not be processed locally, generating metadata indicating a preferred remote data service that is configured to process the request remotely.

17. The computer system of claim 16, wherein the instructions that cause transmitting the request to the one or more remote brokers further comprise instructions which when executed cause a particular remote broker, of the one or more remote brokers, to:

send a remote policy request and the metadata to a remote policy access point to provide one or more remote policies that are applicable to the request and the metadata; and

,

upon receiving the one or more remote policies, invoke a remote policy execution point to cause the remote policy execution point to apply the one or more remote policies to the request and the metadata to determine whether the particular remote data service is configured to process the request, and if so, transmitting the request to the particular remote data service for processing the request.

18. The computer system of claim 15, wherein the request is any one of:

a data record create request, a data record read request, a data record update request, or a data record delete request.

19. The computer system of claim 15, wherein the one or more local policies govern access to data persistently stored in local storage devices;

wherein the one or more remote policies govern access to data persistently stored in remote storage devices.

20. The computer system of claim 15, wherein the one or more brokers are federated brokers and cooperate with each other to ensure a uniform compliance with the one or more remote policies.